harness: emit DeferredToolCall only for catalogued targets - #169
Merged
Merged
Conversation
The agent loop was unconditionally emitting a DeferredToolCall event for every tool call that passed unwrap_tool_call, even when the tool name was not actually in the deferred catalogue. This misrepresented the outcome to audit consumers, since admission would either execute the call as a direct tool or reject it as unknown or hidden. The event is now only emitted when the tool name is found in the catalogue that the bridge searched. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
…emit deferred events Add an integration test that verifies only tools registered with `ToolExposure::Deferred` produce a `DeferredToolCall` event when invoked through the wrapping middleware, while direct and hidden tools do not. This ensures the deferral logic correctly filters by exposure level rather than by tool name alone. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
|
Warning Review paused — included plan limit reachedKeep your review moving with free on-demand reviews.
On-demand reviews are free for one more day. Promotion and pricing detailsOn-demand reviews are free for one more day. After that, they cost $0.25 per reviewed file. Review limit detailsOr wait 7 minutes for your next included review. Limit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (2)
Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Member
Author
|
PR babysitter status
Ready for |
senamakel
added a commit
that referenced
this pull request
Sep 19, 2026
Brings in PR #169 (emit DeferredToolCall only for catalogue targets) on top of the previous merge. No conflicts; the change is confined to the discovery-bridge admission path and its integration test, which is independent of the tinytools-agent dialect recovery this branch adds. Verified: cargo fmt --check, clippy -D warnings, build --all-targets, test --workspace, and the basic_graph example all pass. Co-authored-by: Medulla <medulla@tinyhumans.ai>
Tiny Sweeper reviewTiny Sweeper reviewed this change across 6 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below. State: Ready for maintainer review Review snapshot
Completeness: Complete What changedThe review could not produce a supported behavioral summary; inspect the cited changed surface and lane details below. FeaturesNone identified with supported citations. TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. FindingsNo active actionable findings. Before mergeNone. How this fits togetherflowchart LR
n0["execute_tools_concurrently"]:::impacted
n1["finish_tool_call"]:::impacted
n2["admit_tool_call"]:::impacted
n3["execute_tools_serially"]:::impacted
n4["fail_tool_call"]:::impacted
n5["RunContext"]:::impacted
n0 -->|calls| n1
n0 -->|calls| n2
n0 -->|calls| n4
n0 -->|uses| n5
n1 -->|calls| n4
n1 -->|uses| n5
n2 -->|uses| n5
n3 -->|calls| n1
n3 -->|calls| n2
n3 -->|calls| n4
n3 -->|uses| n5
n4 -->|uses| n5
classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff
Agent review detailscritique
security
tests
commits
description
e2e
Evidence and run details
|
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
There was a problem hiding this comment.
tinysweeper found nothing blocking. Approving.
$0.0088 · 180,606 in / 6,525 out · 12,476 cached (7%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 386 embedded
critique: $0.0041 · 77,715 in / 1,931 out · 8,128 cached (10%) · gpt-5.6-luna
security: $0.0042 · 77,591 in / 1,348 out · 1,788 cached (2%) · gpt-5.6-luna
tests: $0.0003 · 15,505 in / 825 out · 1,536 cached (10%) · deepseek-v4-flash
description: $0.0001 · 6,986 in / 658 out · 1,024 cached (15%) · deepseek-v4-flash
tinysweeper
Bot
added
the
priority: p3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #163.
unwrap_tool_callonly validates thetool_callwrapper's shape, so a model can wrap a direct, hidden, or fabricated name just as validly. The loop emittedAgentEvent::DeferredToolCallunconditionally on unwrap, telling an audit consumer "a deferred call happened" for a call that admission then ran as a direct tool or rejected as unknown. Now the event is emitted only when the unwrapped target is in the run's deferred catalogue; the rewrite to the real name still happens in every case so admission decides the outcome as before.Regression test:
tool_callwrapping a direct, a hidden, and a deferred name — the direct runs, the hidden is rejected, the deferred runs, and exactly oneDeferredToolCall(for the deferred one) is recorded.This was the last unpushed commit from the #163 babysitting run.
Verification
cargo fmt --checkcargo clippy --workspace --all-targets -- -D warningscargo test --workspace— all greenCo-authored-by: Medulla medulla@tinyhumans.ai